Good morning.

We have a system in place where if a transaction meets certain parameters within our card processor's fraud system, a fraud rule is triggered and the transaction is declined and the cardholder receives a text asking to confirm if the transaction is legitimate. A "yes" response to the text confirms the declined transaction was legitimate activity, and subsequent purchase attempts from that source will not trigger the fraud rule.

If they say "no" it will block the card from all further transactions and the cardholder is advised to contact us to dispute the rtxn and get a new card.

From time to time, we have cardholders that get "confused" and says yes to the alert when they meant to say no. From time to time it is a transaction that can't be charged back (eg, emv, card present token, verified by visa etc)

Yes.... the rtxn is unauthorized.... but does the cardholder have any culpability for answering the alert incorrectly? Is the cardholder answering the alert "yes this is legitimate" sufficient evidence to say the transaction is not unauthorized and deny claim?

Wondering how others might handle this.

Thanks, as always.

No. A consumer does not forfeit their rights to claim an EFT error occurred solely on the basis of responding incorrectly to a text message. This may fall under customer negligence but as noted in the commentary to 1005.6(b) you cannot use negligence as a reason for increasing a customer's liability. Customer liability for unauthorized transactions is based solely on how soon they notify you of an error after learning of the loss or theft of their access device 1005.6(a) - (b), and how soon they notify you of an error that appears on their periodic statement 1005.6(c).

My experience with a fraud detection algorithm is a bit different. I got a notice from my credit card issuer that it had declined two successive attempts to use my card number for a $499 bitcoin purchase. I had never made such a purchase in the past, and the fraud detector refused the authorization. For that I was thankful.

But there was no option to say "Yes" or "No" to future purchase transactions. There was an opportunity to flag any of the other purchases over the two or three days prior to the $499 attempts, to indicate they had not been authorized. As it happened, they were all legit. There was also no option to keep the card active. It had already been canceled and a new card was on its way. I got it three days later.

I have had no similar experience with my debit card (from a different bank).

Thanks Brian, that was my line of thinking of well, was asked to get some other opinions.

For another persepctive, I have a credit card at another FI than my place of work. They have something similar where if a transaction triggers a rule, it declines and blocks the card. I don't get a text, but I can go into their mobile app and there will be an alert that I can say yes or no to whether it is legit. If I say yes it's legit, the card unblocks, and the next transaction from the merchant that triggered the alert will not trigger as fraud. If I say no it's not.... the card remains block and I'm guided to contact customer service for next steps. If I don't answer the notification in the app I get a phone call after a period of time.

I did leave out that our app blocks the card at the time the fraud rule fires as well as declining the questionable transaction--but once the cardholder acknowledges the alert as legit activity, the gate reopens.

We changed ours to ask the customer to respond to authorized or unauthorized because we did get some confusion using Yes or No.

and what happens to the transaction when a client doesn't respond either way? because i can tell you, if you text my wife, it may be a week or longer before she responds.

not too long ago at 8:30 AM on a saturday i received a phone call at home and they said "this is so and so from the bank, i guess since you are answering the phone at home you aren't in england making a purchase at such and such business. i confirmed i was not in england but i would be willing, at the bank expense, to testify in trial in england about the unauthorized use.

i believe with the amount of fraud that has been seen of late, and the addition of visa purchase alerts, we are not making proactive calls on these items.

One more thing to consider - how can you be certain it is actually your cardholder answering "yes" or "no" to the text?

I think there is a case to be made for communicating with the consumer and getting authorization for text confirmations of transactions over a certain limit or based on a geography. Done right, and clear, that "Yes, I authorize this transaction" should serve as an authorized transfer. If the consumer then says they never received such as text, that needs to be investigated and the burden is always on the bank to prove it was the consumer. As an example, if I never lost my phone or allowed someone to use it, that confirmation would be more positive. If however I lost my laptop, which receives my text messages as my phone does, a thief who got into my laptop could easily have sent an approval. Similarly, if my phone was unlocked and lacked security, a person borrowing the phone may be able to transfer funds and approve the transaction. That needs to come out in a reasonable investigation.

I hear cases where the bank called a consumer who said Yes it was authorized and later says No, it wasn't casts a doubt in my mind as I'd say its authorized, especially when they admit it was, but then they reconsidered - well after the transfer happened. You have to be sure its your customer and you're talking about the same transfer.

At the end of the day, it's not conclusive but its better than nothing. Driving security and preventive measures into consumers minds may be the best way to limit losses at this point.

We just had this happen Customer got a call from our fraud center, said "yes, the transaction is authorized". Later that day, she realized that the transaction she was being contacted about was a DIFFERENT transaction (to the same vendor, and close in amount) than the actual transaction she authorized. It was simply a mistake on her part - fortunately, not much else got through before she realized the mistake.

We have a customer that answered "yes" to the authorization text for the first of several transactions. She later disputed these transactions as unauthorized. She admitted that she confirmed the authorization the first time, but it was the only alert she received.

We have denied the claim based on the text response and her confirmation that she provided the text.

I still find this troubling and would like any thoughts. I can agree with denying the first transaction - she not only answered, but confirmed she answered. The rest, I'm not quite convinced. Just because I authorize one transaction to merchant.com, even if I receive whatever merchandise, doesn't necessarily mean I authorized another 20 transactions.

For context - this isn't a subscription with a hidden "must cancel" date. These are all individually executed transactions, they don't fit her normal purchase pattern, many are conducted at very late hours (1, 2, or 3 am), and she is an elderly customer. She states that she has never knowingly lost possession of her card - but that's as simple as someone taking her card info and slipping the card back unknown.

Any thoughts, please?

"she later disputed these transactions...it was the only alert she received..."

simply confirming one purchase does not approve all future purposes. has any investigation been done, or is it a flat denial based one the first approval? How is it going to look when the elderly person gets assistance from someone and your bank makes the news for denying to assist an elderly person? have you looked at elder abuse, as your state may mandate? and she said she hasn't received subsequent texts?

i'd be knee deep in an investigation here...

"they don't fit her normal purchase pattern..." honestly, what more do you need?

The commentary to 1005.6(b) notes that you cannot use customer negligence as a reason to increase their liability. The fact that a customer incorrectly responded to a fraud alert does not eliminate their protections under Regulation E. Your investigation needs to conclude that they did, in fact authorize the charges that they are disputing. Their response to a fraud alert may be one piece of your investigation as there are fraudsters who try to game the system by intentionally deceiving the bank, but this by itself is not adequate to deny a claim.